Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Dazed and Confused: A Large-Scale Real-World User Study of ReCAPTCHAv (2023)

arxiv.org

Post reply on HN
Print view View original

61–65 of 65 posts

Re: Dazed and Confused: A Large-Scale Real-World User Study of ReCAPTCHAv (2023)

#61

Post by whakim »

tpxl wrote: post #14
Closi wrote: post #13

> We explore the cost and security of reCAPTCHAv2 and conclude that it has an immense cost and no security. Overall, we believe that this study's results prompt a natural conclusion: reCAPTCHAv2 and similar reCAPTCHA technology should be deprecated. Not sure I 100% agree with the conclusion. IMO they currently still offer some level of security against unsophisticated actors, not no security. And something can be bad…

Captcha is nothing like a lock. It's a little guy that gives you a run around before you get to insert your key. It does very little to stop the bad actors (if there's a payday at the other end of the runaround, they'll do it), but annoys (and is a slap in the face for) every single legitimate user.

You could make the exact same argument about locks (which are trivially defeated) - add up all the time that people spend unlocking doors and I'm sure you'd end up with a huge amount of time; add up all the money that people spend on locks and keys and I'm sure you'd end up with a huge amount of money. Should we logically conclude that locks are just a giant grift by Big Key? I'm sympathetic to the ickiness of captchas, but the paper never addresses the counterfactual of what might happen if there were no captchas at all.

Re: Dazed and Confused: A Large-Scale Real-World User Study of ReCAPTCHAv (2023)

#62

Post by Closi »

mitchitized wrote: post #35
mitchitized wrote: post #34

Earlier quoted context omitted.

Not only that, but adding insult to injury - the whole captcha process is being abused by Google for their surveillance capitalism. Just load a captcha-blocked page in a fresh browser with no google accounts every being used - you got like a 1% chance of getting through. Login to google, and BOOM you're in.

From the study: "In terms of cost, we estimate that – during over 13 years of its deployment – 819 million hours of human time has been spent on reCAPTCHA, which corresponds to at least $6.1 billion USD in wages. Traffic resulting from reCAPTCHA consumed 134 Petabytes of bandwidth, which translates into about 7.5 million kWhs of energy, corresponding to 7.5 million pounds of CO2. In addition, Google has potentially p…

The $888 billion profit figure seems suspect - Google annual profit is currently $30.7B so that's almost 30 years of profit at current run-rate.

Re: Dazed and Confused: A Large-Scale Real-World User Study of ReCAPTCHAv (2023)

#63

Post by Closi »

tpxl wrote: post #18
eptcyka wrote: post #15

Earlier quoted context omitted.

It takes a script kiddy considerably more effort to circumvent a captcha than just automating a site via curl or chromium. This difference is the increase in cost of an attack. This is the security gain.

A script kiddie downloads a script that does it for them. The hard work of solving captchas automatically was already done, for free (linked in this very thread).

And then google changes something in the Captcha code and it stops working, then you change solve libraries and then you get it back up but need more complex hosting infra because solves take 10 seconds and you have to simulate human behaviour, then that goes down, then you have to use some new solve service which is a paid API, and then your VM is detected by Google as a bot and suddenly you are blocked across all websites using Recaptcha, so then you have to rebuild your infra...

Compared to 10 minutes and selenium.

Re: Dazed and Confused: A Large-Scale Real-World User Study of ReCAPTCHAv (2023)

#64

Post by tpxl »

whakim wrote: post #61
tpxl wrote: post #14

Earlier quoted context omitted.

Captcha is nothing like a lock. It's a little guy that gives you a run around before you get to insert your key. It does very little to stop the bad actors (if there's a payday at the other end of the runaround, they'll do it), but annoys (and is a slap in the face for) every single legitimate user.

You could make the exact same argument about locks (which are trivially defeated) - add up all the time that people spend unlocking doors and I'm sure you'd end up with a huge amount of time; add up all the money that people spend on locks and keys and I'm sure you'd end up with a huge amount of money. Should we logically conclude that locks are just a giant grift by Big Key? I'm sympathetic to the ickiness of captch…

Locks protect the user, captcha protects the company.

Re: Dazed and Confused: A Large-Scale Real-World User Study of ReCAPTCHAv (2023)

#65

Post by jfdjkfdhjds »

turblety wrote: post #28
buro9 wrote: post #11

I abandon 1 in 10 captchas recently. They're becoming so abstract and confusing, few are on sites that I critically need to persevere with. Of the ones I do, I need to regenerate about a third as I'm slightly colour blind, but apparently enough to not see whatever they need me to see. Mostly I won't sign up to a service that has a captcha unless I know in advance it's a service I need (unlikely), it's an immediate cl…

If you live in Europe or a country that has discrimination laws against less abled users, you should raise a complaint if a website uses Captcha's. I believe captchas are unnecessary and make life more difficult for visually and motor impaired users. However, there are loads of captcha solving services you can sign up to that just solve them for you for basically free. For example, 2captcha. You install a browser ext…

lol. I did after being hellbanned by recaptcha for clearing cookies. they reply that there's nothing to be done. and you are expected to start legal action.

all just so they can save 50c on bandwidth for bots against a public data website.

Post reply on HN